Add trusted Ops CI policy workflow - #1

Summary

• add a public, secretless required-workflow source for slowchop/ops
• inspect only Git commit/tree metadata on GitHub-hosted runners
• require .github/workflows/ci.yml to be the exact hardened regular blob at each pull-request head
• self-test this public workflow on slowchop/.github; verify production policy only on slowchop/ops; reject every other repository
• never check out or execute target-repository code and never download the protected file contents
• fail closed for the wrong repository, base, event, head, path type/mode, ambiguous metadata, malformed metadata, truncation, or blob ID

Validation

• verifier fixture suite
• ShellCheck
• actionlint
• whitespace/diff validation
• independent security review: GO, no P0-P2
• source-repository hosted self-test at the exact PR head

Rollout gate

The verifier now pins hardened Ops CI blob 5a067cd347b739c0e7f79fd07be18f5f5e56b342, verified as .github/workflows/ci.yml on Ops main commit deb0473038f9512dc0f68489c62d074bb3d8af7c (merged PR #6).

This draft does not change organization or target-repository settings. After this PR is separately approved and merged, repin the existing disabled organization workflow rule to the resulting trusted-workflow source commit, run a canary against slowchop/ops, and review the result before any activation.

Do not activate the organization rule from this draft.